#! /bin/sh 

# 更新系统
yum update -y
yum install -y yum-utils
yum -y install wget
timedatectl set-timezone Asia/Shanghai 
yum install -y ntpdate
systemctl stop firewalld
systemctl disable firewalld.service 

# 安装 jdk
cd /usr/local
tar -zxvf jdk-8u191-linux-x64.tar.gz

echo '
export JAVA_HOME=/usr/local/jdk1.8.0_191/ 
export CLASSPATH=$:CLASSPATH:$JAVA_HOME/lib/ 
export PATH=$PATH:$JAVA_HOME/bin

'>>/etc/profile

source /etc/profile

# 安装nginx
if [ ! -f "/usr/local/nginx-1.18.0.tar.gz" ]; then
wget -cP /usr/local https://gitee.com/y_lx/study/raw/master/linux/bak/bs/nginx-1.18.0.tar.gz
fi

yum -y install gcc pcre-devel zlib-devel openssl openssl-devel
cd /usr/local/
tar zxvf nginx-1.18.0.tar.gz
cd /usr/local/nginx-1.18.0
./configure --prefix=/usr/local/nginx --with-http_stub_status_module --with-http_ssl_module
make
make install

cd /usr/local/nginx/
rm -rf /usr/local/nginx/conf/nginx.conf
wget -cP /usr/local/nginx/conf/  https://gitee.com/y_lx/study/raw/master/linux/bak/bs/nginx.conf
wget -cP /usr/local/nginx/zs/ https://gitee.com/y_lx/study/raw/master/linux/bak/bs/xxx.pem
wget -cP /usr/local/nginx/zs/ https://gitee.com/y_lx/study/raw/master/linux/bak/bs/xxx.key


useradd nginx -m
passwd -l nginx

mkdir -p /usr/cloud
chmod 777 -R /usr/local/nginx/
chmod 777 -R /usr/cloud
chmod 644 -R /usr/local/nginx/conf/nginx.conf

ln -sf /usr/local/nginx/sbin/nginx /usr/bin/nginx
nginx

# 创建启动jar目录
rm -rf /jar/start.sh
wget -cP /jar/ https://gitee.com/y_lx/study/raw/master/linux/bak/bs/start.sh
chmod +7 /jar/start.sh

#创建软链接 使用jar start all命令
ln -s /jar/start.sh /usr/bin/jar

rm -rf /jar/bootstrap.properties
wget -cP /jar/ https://gitee.com/y_lx/study/raw/master/linux/bak/bs/bootstrap.properties

if [ ! -f "/jar/application.properties" ]; then
wget -cP /jar/ https://gitee.com/y_lx/study/raw/master/linux/bak/bs/application.properties
fi

# 开机启动 nginx 所有服务
sudo tee /etc/rc.d/init.d/autostart.sh<<-'EOF'
#!/bin/sh
#chkconfig:2345 80 90
#decription:autostart

/usr/local/nginx/sbin/nginx

/jar/start.sh start all

EOF

chmod 755 /etc/rc.d/init.d/autostart.sh

cd /etc/rc.d/init.d
chkconfig --add autostart.sh
chkconfig autostart.sh on

# 安装 docker

yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
yum -y makecache fast

#安装	
yum -y install docker-ce-18.03.1.ce
yum -y install docker

#加速配置
mkdir -p /etc/docker
tee /etc/docker/daemon.json <<-'EOF'
{
  "registry-mirrors": ["https://docker.mirrors.ustc.edu.cn/","https://almtd3fa.mirror.aliyuncs.com"]
}
EOF

#启动	
systemctl start docker
#开机启动	
systemctl enable docker


# 安装 redis
docker run -d -m 4g --name myredis -p 6379:6379 --restart unless-stopped redis:3.2 --requirepass "123"

# 安装ES
mkdir -p /docker/elasticsearch/config
tee /docker/elasticsearch/config/elasticsearch.yml <<-'EOF'
cluster.name: "docker-cluster"
network.host: 0.0.0.0
http.cors.enabled: true
http.cors.allow-origin: "*"
action.destructive_requires_name: true
EOF
docker run -d -e "ES_JAVA_OPTS=-Xms2g -Xmx2g"  --name elasticsearch -p 9200:9200 -p 9300:9300 -e "discovery.type=single-node" --restart unless-stopped -v /docker/elasticsearch/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml elasticsearch:7.16.1

#安装 nacos
docker run -d -m 2g  -e PREFER_HOST_MODE=ip -e MODE=standalone -p 8849:8848 --name nacos1.4.1 --restart=always nacos/nacos-server:1.4.1

# 安装 rabbit mq
docker run -d -m 2g  --hostname my-rabbit --name rabbit -p 15672:15672 -p 5672:5672 --restart=always rabbitmq:3.7.7-management
# 安装延时队列
docker cp /usr/local/rabbitmq_delayed_message_exchange-3.8.0.ez rabbit:/plugins
docker exec rabbit rabbitmq-plugins enable rabbitmq_delayed_message_exchange
docker restart rabbit


# 审计
echo '
-w /var/lib/docker -k docker
-w /etc/docker -k docker
-w /usr/lib/systemd/system/docker.service -k docker
-w /usr/lib/systemd/system/docker.socket -k docker
-w /usr/bin/docker-containerd -k docker
-w /usr/bin/docker-runc -k docker
'>>/etc/audit/audit.rules


echo '
-w /var/lib/docker -k docker
-w /etc/docker -k docker
-w /usr/lib/systemd/system/docker.service -k docker
-w /usr/lib/systemd/system/docker.socket -k docker
-w /usr/bin/docker-containerd -k docker
-w /usr/bin/docker-runc -k docker
'>>/etc/audit/rules.d/audit.rules

service auditd restart



#限制容器之间的网络流量
tee /usr/lib/systemd/system/docker.service<<-'EOF'
[Unit]
Description=Docker Application Container Engine
Documentation=https://docs.docker.com
After=network-online.target firewalld.service
Wants=network-online.target

[Service]
Type=notify
ExecStart=/usr/bin/dockerd --icc=false
ExecReload=/bin/kill -s HUP $MAINPID
LimitNOFILE=infinity
LimitNPROC=infinity
LimitCORE=infinity
TimeoutStartSec=0
Delegate=yes
KillMode=process
Restart=on-failure
StartLimitBurst=3
StartLimitInterval=60s

[Install]
WantedBy=multi-user.target

EOF

systemctl daemon-reload
systemctl restart docker
